Method for performing group key-based protocol using bmanf and bmanf node thereof

Abstract

The present invention relates to a method for executing a group key-based protocol utilizing BMANF and to a BMANF node, wherein the method comprises: a protocol initial phase in which a mutually shared key is distributed to each of the UE node and the BMANF node, and when a ticket generated by the BMANF node in accordance with a ticket request of the UE node is transmitted to the UE node, the shared key is deleted from each of the UE node and the BMANF node; and a protocol verification phase initiated upon completion of the protocol initial phase, wherein when a broadcast message (BM) is transmitted to the UE node by the plurality of gNB nodes, a list regarding the broadcast message is generated by the UE node, and when a verification result generated by the BMANF node in accordance with a verification request of the UE node is transmitted to the UE node, a measurement report (MR) is transmitted from the UE node to each gNB node in accordance with the verification result.

Description

Technology Field

[0001] The present invention relates to a group key-based protocol technology, and more specifically, to a method for executing a group key-based protocol utilizing BMANF and a BMANF node that can prevent the reception of broadcast messages from FBS (Fake Base Station), improve the data quality of the SON (Self-Organizing Network) function, and protect the network from SON poison attacks. Background Technology

[0003] Self-Organizing Networks (SONs) can play a critical role in networks by enhancing overall network performance through Self-x functions such as automatic configuration, healing, and optimization. The primary goal of SONs ​​is to provide intelligence to mobile networks to facilitate their organization, configuration, optimization, and recovery, offering the advantage of minimizing total network complexity, capital expenditures, and operating costs. Combined with sophisticated algorithms, SON technology will ensure better network performance than previous generations; when combined with autonomous learning, this will make future mobile networks much more proactive than current ones, bringing greater innovation and change to 5G.

[0004] The SON function can be performed on access network components along with critical applications such as load balancing—a technology that ensures the smooth operation of a site through remaining servers even if one server fails—mobility management, handover optimization, and backhaul optimization that occur when a terminal moves from the service space of a connected base station to the service space of another base station. Accordingly, the SON function can operate at a high level by collecting and analyzing Measurement Reports (MRs) retrieved from User Equipment (UEs) connected to the network, which are protected from malicious programs and space programs.

[0005] However, security risks may exist because data can be poisoned through an attack known as SON Poison. This issue can cause Denial of Service (DoS) attacks against both the UE and the network, as well as cell outages and signaling floods. Consequently, UEs are generally unable to verify the authenticity of System Information (SI) messages transmitted from gNodeBs or 5G base stations, which can lead to the communication of MRs containing false information to the currently connected gNB. Thus, unverified messages have the potential to lead to SON Poison attacks. To defend against such attacks, Serving Networks (SNs) must verify the reliability of MRs and consider key technologies such as encryption and intrusion detection and prevention. Prior art literature

[0007] Korean Registered Patent No. 10-2155204 (2020.09.07) The problem to be solved

[0008] One embodiment of the present invention aims to provide a group key-based protocol execution method utilizing BMANF and a BMANF node that can prevent the reception of broadcast messages from FBS (Fake Base Station), improve the data quality of SON (Self-Organizing Network) functions, and protect the network from SON poison attacks. means of solving the problem

[0010] Among the embodiments, a method for executing a group key-based protocol utilizing BMANF comprises: a protocol initial phase in which a mutually shared key is distributed to each of the UE node and the BMANF node, and when a ticket generated by the BMANF node in accordance with a ticket request of the UE node is transmitted to the UE node, the shared key is deleted from each of the UE node and the BMANF node; and a protocol verification phase initiated upon completion of the protocol initial phase, wherein when a broadcast message (BM) is transmitted to the UE node by the plurality of gNB nodes, a list regarding the broadcast message is generated by the UE node, and when a verification result generated by the BMANF node in accordance with a verification request of the UE node is transmitted to the UE node, a measurement report (MR) is transmitted from the UE node to each gNB node in accordance with the verification result.

[0011] Each of the above multiple gNB nodes can mutually share a root key that is provisioned by the AMF node and periodically updated.

[0012] Each of the above multiple gNB nodes can generate a base station key from the root key based on the corresponding group identifier and generate an HMAC of the broadcast message using the base station key.

[0013] The above protocol initial step may include a step of distributing the shared key to each of the UE node and the BMANF node according to the 5G registration mechanism.

[0014] The above protocol initial step may include the step of the UE node encrypting Temporary Mobile Subscriber Identity (TMSI) based on the shared key and transmitting a ticket request message containing the encrypted Temporary Mobile Subscriber Identity to the BMANF node.

[0015] The above protocol initial step may include a step in which the ticket request message is decrypted by the BMANF node based on the shared key, and if the first timestamp included in the ticket request message is valid, a ticket and a ticket exchange key for the UE node are generated.

[0016] The initial step of the above protocol may include the step of the BMANF node encrypting the ticket and ticket exchange key based on the shared key and transmitting a ticket response message containing the encrypted ticket and ticket exchange key to the UE node.

[0017] The above protocol initial step may include a step in which the ticket response message is decrypted by the UE node based on the shared key, and if the second timestamp included in the ticket response message is valid, the ticket and ticket exchange key are stored.

[0018] The above protocol verification step may include a step in which, when the broadcast message and the corresponding HMAC are transmitted to the UE node by each of the plurality of gNB nodes, a list regarding the broadcast message and the HMAC is generated by the UE node.

[0019] The above protocol verification step may include the step of transmitting to the BMANF node, together with the ticket stored in the above protocol initial step, the broadcast message, the list regarding HMAC, and the third timestamp, after being encrypted based on the ticket exchange key stored in the above protocol initial step by the UE node.

[0020] The above protocol verification step may include the step of decrypting the ticket based on the secret key by the BMANF node and verifying the HMAC of the broadcast message if the third timestamp is valid, and if the verification is successful, transmitting a success message with a fourth timestamp, and if not, generating a list of the broadcast messages and transmitting them with the fourth timestamp and a failure message.

[0021] The above protocol verification step may include a step in which, by the UE node, the measurement report is transmitted to the plurality of gNB nodes if the fourth timestamp of the verification result is valid, and otherwise, the measurement report is transmitted to the remaining gNB nodes excluding the gNB nodes that failed the verification.

[0022] Among the embodiments, a BMANF (Broadcast Message Authentication Network Function) node is a BMANF node configured to perform a group key-based protocol execution method with a UE (User Equipment) node when a plurality of gNB nodes form different groups within a tracking area managed by an AMF (Access and Mobility Function) node, and comprises: a transmitting and receiving unit; at least one processor; and a memory connected to and operating with said at least one processor and storing instructions for said at least one processor to perform a plurality of steps, wherein the plurality of steps include: receiving a shared key mutually shared with said UE node from said AMF node; receiving a ticket request from said UE node; generating a ticket for said UE node according to said ticket request; deleting the shared key after transmitting said ticket to said UE node; and, when a verification request is received from said UE node, generating a verification result and transmitting it to said UE node. Effects of the invention

[0024] The disclosed technology may have the following effects. However, this does not mean that a specific embodiment must include all of the following effects or only the following effects; therefore, the scope of the rights of the disclosed technology should not be understood as being limited by this.

[0025] A method for executing a group key-based protocol using BMANF according to one embodiment of the present invention and a BMANF node can prevent the reception of broadcast messages from FBS (Fake Base Station), improve the data quality of the SON (Self-Organizing Network) function, and protect the network from SON poison attacks. Brief explanation of the drawing

[0027] Figure 1 is a diagram illustrating a protocol using a group key-based solution to respond to FBS. Figure 2 is a diagram illustrating a system model using the BMANF function according to the present invention. Figure 3 is a diagram illustrating the initial stage of a group key-based protocol utilizing BMANF according to the present invention. Figure 4 is a diagram illustrating the verification step of a group key-based protocol utilizing BMANF according to the present invention. Figure 5 is a diagram illustrating the delay time of the encryption operation. Figure 6 is a diagram comparing and explaining the performance and security of a false base station defense system. Figure 7 is a diagram illustrating the performance comparison of false base station defense mechanisms. FIG. 8 is a diagram illustrating the system configuration of a BMANF node according to the present invention. FIG. 9 is a flowchart illustrating an example of the operation process of a BMANF node according to the present invention. Specific details for implementing the invention

[0028] The description of the present invention is merely an example for structural or functional explanation, and therefore the scope of the present invention should not be interpreted as being limited by the examples described in the text. That is, since the examples are subject to various modifications and may take various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical concept. Furthermore, the objectives or effects presented in the present invention do not imply that a specific example must include all of them or only such effects; therefore, the scope of the present invention should not be understood as being limited by them.

[0029] Meanwhile, the meaning of the terms described in this application should be understood as follows.

[0030] Terms such as "first," "second," etc., are intended to distinguish one component from another, and the scope of rights shall not be limited by these terms. For example, the first component may be named the second component, and similarly, the second component may be named the first component.

[0031] When it is stated that one component is "connected" to another component, it should be understood that it may be directly connected to that other component, or that there may be other components in between. Conversely, when it is stated that one component is "directly connected" to another component, it should be understood that there are no other components in between. Meanwhile, other expressions describing the relationships between components, such as "between" and "exactly between," or "adjacent to" and "directly adjacent to," should be interpreted in the same way.

[0032] A singular expression should be understood to include a plural expression unless the context clearly indicates otherwise, and terms such as "include" or "have" are intended to specify the existence of the implemented features, numbers, steps, actions, components, parts, or combinations thereof, and should be understood not to preclude the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0033] In each step, identifiers (e.g., a, b, c, etc.) are used for convenience of explanation and do not describe the order of the steps; the steps may occur differently from the specified order unless a specific order is clearly indicated in the context. That is, the steps may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

[0034] The present invention may be implemented as computer-readable code on a computer-readable recording medium, and the computer-readable recording medium includes all types of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. Additionally, the computer-readable recording medium may be distributed across networked computer systems, so that computer-readable code can be stored and executed in a distributed manner.

[0035] Unless otherwise defined, all terms used herein have the same meaning as generally understood by those skilled in the art to which this invention pertains. Terms defined in commonly used dictionaries should be interpreted as having meanings consistent with the context of the relevant technology and should not be interpreted as having an ideal or overly formal meaning unless explicitly defined in this application.

[0036] In addition, the symbols used here can be defined as shown in Table 1 below.

[0037] sign explanation Private key of Entity X Shared key between entities X and Y Unique identifier of Entity X Entity X's ticket Key for ticket exchange Ticket expiration time Root key of a shared root key group Key for each base station nth timestamp Symmetric encryption of message M using key K Hash-based message authentication code of message M using key K List of A and B tuples connective

[0038] The 3GPP (3rd Generation Partnership Project), which leads mobile communication standardization, has proposed many solutions to network security issues through the use of Public Key Certificates (PKC), Identity-Based Cryptography (IBC), and group keys. The following describes three representative solutions.

[0039] 1) Public Key Certificate-Based Solution

[0040] Public key certificate-based solutions enable UEs to verify the reliability of broadcast messages (BMs) (e.g., disaster alerts) transmitted in plaintext without encryption, without the need for UEs to share signing keys. Additionally, during the transmission of “Registration Accept” and “Location Update Accept” messages exchanged between the Access and Mobility Management Function (AMF) and the UE via Non-Access Stratum (NAS) signaling for terminal network access in the 5G Core Network (CN) and terminal location registration, the former can transmit a list of tracking area IDs along with the public key and lifespan corresponding to the latter. Furthermore, network operators provide private keys corresponding to New Radio (NR), a type of 5th generation mobile communication technology, which can be used to sign SIs using other information such as time counters, downlink frequencies, and Physical Cell Identity (PCI). Including this additional information can make it difficult for attackers to perform replay attacks.

[0041] Subsequently, the NR can broadcast a digital signature along with the minimum time counter and SI to resolve errors introduced due to the time counter difference between the UE and the wireless network. The UE can verify the digital signature and time counter using the public key stored for that specific trace area, and public key-based solutions can use PKI for SI protection. Afterward, the gNB can sign the BM with its private key and transmit it to the UE along with a plain message and certificate. Next, the UE can verify the received certificate using the root certificate provided during manufacturing or during the “registration approval” message. Both of these solutions can delegate the digital signature SI to a new network function called the Digital Signing Network function (DSnF).

[0042] 2) ID-based encryption solution

[0043] Another method for SI verification may be for the core network to provide different 'credentials' to the NR and UE for a certificateless signature algorithm. Additionally, the core network may provide the NR with a private signing key for the SI signature and provide each cell with a unique public validation token to verify the UE's signature. Additional solutions in this category may utilize a Private Key Generator (PKG) along with public and private keys. The public key is programmed into the UE at manufacturing or via a command completion message in non-accessible security mode, while the private key can be kept secret. Subsequently, the PKG can generate a signing key for the gNB using the gNB's ID and private key, and when a BM containing a digital signature is received, the UE can verify it using the PKG's public key and the gNB's ID.

[0044] 3) Group Key-Based Solution

[0045] A group key-based method for BM protection can operate between the UE, SN (Serving Network), and HN (Home Network) in a 5G environment. The SN automatically supplies the gNB's key to the UE (specifically, the Mobile Equipment (ME)), which is encrypted with the support of the HN and cannot be decrypted by the ME; as shown in Fig. 1, this can be composed of a three-step procedure: Protection Key Agreement Transfer (PKAT), Protection Area Information Provisioning (PAIP), and Cell Authentication. In the first step of the authentication procedure, the protection key ( ) can be agreed upon between the HN (AUSF / UDM) and the UE, and the same key can be transmitted to the SN (AMF / SEAF) for subsequent procedures. Since long-term keys are found only in the Universal Subscriber Identity Module (USIM) and the HN, only the USIM It is necessary to note that it can be calculated accurately.

[0046] During the PAIP procedure, the SN can optimize the number of encrypted keys supplied to the ME by providing the encrypted root keys of the group in the PA (referred to as the Shared Root Key Group (SRKG)) to the UE. The SRKG is represented by a Group Key Identifier (GKI), whereas the gNBs of the SRKG can be identified by a unique Group Node Identifier (GNI). The SN provides the GKI and GNI to the corresponding gNBs. = HMAC-SHA-256( ,<GKI, GNI> ) can be calculated. Here, is the root key shared by the gNB group. After that, SN is It can provide to the corresponding gNB. Once this initial setup is complete, the SN, based on the UE's registration request, provides a list of PA information (GKI, and lifespan included, here Is After obtaining the (encrypted as) information, the gNB can return a registration response to the UE along with the PA information. In the final step, the gNB uses the SI's message authentication code (including GKI and GNI) )and The downlink frequency with can be calculated. And, It broadcasts the GKI and GNI, where the UE receives and verifies whether the GKI exists in the PA information. Finally, the ME ,<GKI, GNI> It can be transferred to the USIM, and the USIM is ( (using ) cast It can be decrypted as, Based on It can calculate the expected message authentication code ( It can calculate ). After that, the USIM is Send to ME It can be compared with.

[0047] Schemes utilizing public key authentication and ID-based keys protect against wireless intruders who use asymmetric keys to replay previously recorded SI messages or send maliciously configured messages to perform SON Poison attacks. While this approach plays a crucial role in authenticating the BM without sharing secret keys in advance, it can result in high computational overhead due to costly operations. Furthermore, it may require a costly Public Key Infrastructure (PKI) to manage digital signatures and public key cryptography, and IBCs face the issue of being impractical. However, group key-based schemes rely on collaboration between the Service Network (SN) and the Home Network (HN) for the dynamic provisioning of session keys and the computation of Message Authentication Codes (MACs) between the UE and gNB. Nevertheless, group key-based schemes may still face security issues related to insider threats.

[0048] Therefore, to solve these problems, the improved protocol in each group according to the present invention can perform an improved group key protocol by using a new network function called the Broadcast Message Authentication for Broadcast Message Verification (BMANF) rather than the UE directly verifying the BM.

[0049] Hereinafter, a method for executing a group key-based protocol using BMANF according to the present invention will be explained in more detail through FIGS. 2 to 9.

[0051] Figure 2 is a diagram illustrating a system model using the BMANF function according to the present invention.

[0052] Referring to FIG. 2, a protocol execution system (200) according to the present invention may be configured to include an AMF node (210) on a 5G Core Network, a plurality of gNB nodes (230) forming different groups (Group 1, 2), a BMANF node (250) and a UE node (270) of each group.

[0053] The UE node (270) may contact the BMANF node (250) to verify the received BM using its HMAC before transmitting the Measurement Report to the serving gNB node (230). The BMANF node (250) may notify the UE node (270) of the result after verifying the HMAC. Consequently, even if the FBS has transmitted the BM, the BMANF node (250) can verify it before the UE node (270) transmits the MR to the gNB node (230). Thus, it is possible to prevent the gNB node (230) from receiving an incorrect MR.

[0054] Here, the UE node (270) may correspond to a user terminal, the gNB node (230) may correspond to a base station terminal, and the BMANF node (250) may correspond to an independent server or terminal that provides BMANF functions.

[0055] Meanwhile, group key-based technology can offer several advantages, such as improved computing efficiency and reduced group management costs. However, group key-based technology is primarily the group key-based root key Since it is shared with UEs, it can have significant security flaws. Consequently, if an attacker attacks a single group member or joins multiple groups with a UE that is legitimate but has malicious intent, the group key can be exposed, potentially altering the legitimate gNB.

[0056] Accordingly, the protocol execution method according to the present invention may include a Broadcast Message Authentication Network Function (BMANF) to verify the BM on behalf of the UE in order to solve the above problem. That is, while the UE performs the verification process in the case of a 3GPP solution, the protocol utilizing the BMANF according to the present invention may use the BMANF nodes (250) of each group to verify the BM.

[0057] Meanwhile, to securely exchange messages over an unprotected channel, the protocol must be safe from passive attackers who compromise confidentiality by eavesdropping on messages, as well as active attackers (malicious insiders or unauthorized outsiders) who compromise the integrity and availability of communications by modifying or deleting messages. In this context, it may be impossible to decrypt encrypted messages, recover the results of one-way hash functions, or guess random numbers without the correct encryption key. However, it may be appropriate to model security threats by applying a Dolev-Yao (DY) model, which can eavesdrop on all transmitted messages—including those between the UE and gNB—and is aware of all proposed protocol procedures. Furthermore, such an attacker model may pose a risk of exchanging messages with communication participants and forging, retransmitting, or even deleting them.

[0058] Therefore, since the goal of using BMANF according to the present invention is to protect the BM authentication procedure in a 5G environment, it is necessary to satisfy essential security requirements such as secure key exchange and mutual authentication.

[0060] Figure 3 is a diagram illustrating the initial stage of a group key-based protocol utilizing BMANF according to the present invention.

[0061] Referring to FIG. 3, a group key-based protocol utilizing BMANF according to the present invention may include several preconditions. Multiple gNB nodes existing within a tracking area managed by an AMF node (210) may form different groups. The root key is It is provisioned to a gNB node and can be periodically updated by an AMF node (210). Each gNB node (230) can use a group identifier when transmitting a BM and calculates the HMAC of the message. at It can generate. The formula for calculating can be expressed as the following mathematical formula 1.

[0062] [Mathematical Formula 1]

[0063]

[0065] Additionally, the UE node (270) and the AMF node (210) share a key between the BMANF node (250) and the UE node (270). It may include an algorithm derived from, and the BMANF node (250) can communicate with the AMF node (210) by establishing a secure channel. All nodes can be time synchronized.

[0066] In the initial stage of the protocol according to the present invention, the key between the BMANF node (250) and the UE node (270) It can be deployed using an existing 5G registration mechanism. After security activation of the Access Stratum (AS), that is, the wireless communication protocol portion between the wireless network and the UE node (270), the UE node (270) can request a ticket from the BMANF node (250), and the ticket can be used for authentication in a subsequent session.

[0067] Additionally, the initial stage of the protocol in FIG. 3 may include multiple stages. First, the first stage may be performed in accordance with the registration request procedure defined in 3GPP TS 38.331, TS 38.413 and TS 33.51. That is, the UE node (270) may transmit a Registration Request to the AMF node (210).

[0068] Additionally, in steps 2a to 2c, the AMF node (210) from ...can be derived, and then, in accordance with the registration approval procedure defined in the standard as in the first step, a message (2b) is transmitted to the UE node (270), It can be passed to the BMANF node (250).

[0069] Additionally, in steps 3a and 3b, the UE node (270) is in the same manner as the AMF from ...can be derived. Then Using , and can encrypt subscriber information to prevent exposure of the TMSI value, called TMSI (Temporary Mobile Subscriber Identity), including the first timestamp (Timestamp1). Finally, the UE node (270) A ticket can be requested by sending a ticket request message containing an encrypted TMSI to the BMANF node (250).

[0070] Additionally, in steps 4a and 4b, the BMANF node (250) is The message can be decrypted using, and the first timestamp (Timestamp1) can be verified, and if valid and You can write. The formula for calculating can be expressed as the following mathematical formula 2.

[0071] [Mathematical Formula 2]

[0072]

[0074] Afterwards, the BMANF node (250) , , , , and the second timestamp (Timestamp2) It can be encrypted and a “Ticket Response” message can be created and sent to the UE node (270).

[0075] Additionally, in step 5, the UE node (270) can verify the validity of the second timestamp, and if the verification is successful class It can store. Then, the UE node (270) and the BMANF node (250) in their respective memories to ensure perfect forward secrecy (a property that even if the secret key is exposed, it should not affect the security of the session key obtained during the subsequent key distribution process). You can delete it.

[0077] Figure 4 is a diagram illustrating the verification step of a group key-based protocol utilizing BMANF according to the present invention.

[0078] Referring to FIG. 4, the verification step of the protocol according to the present invention may be initiated when the initial step is completed. First, when the UE node (270) triggers the MR transmission conditions set via MeasConfig, the UE node (270) may transmit the BMs of adjacent gNB nodes (230) used to generate MRs and HMACs for a verification request to the BMANF node (250) before transmitting the MR to the serving gNB node (230). Depending on the verification result, the UE node (270) may transmit the MR to the service gNB node or otherwise generate a new MR. If the UE node (270) requests verification from the BMANF node (250), a ticket for authentication It can be transmitted together.

[0079] Additionally, the verification step of the protocol in FIG. 4 may include a plurality of steps. First, in steps 0a and 0b, the gNB node (230) The HMAC of the BM can be generated using . The gNB node (230) can transmit the BM along with the HMAC value to a nearby UE node (270).

[0080] Additionally, in steps 1a and 1b, the UE node (270) may generate a list of BM and HMAC values ​​received from other gNB nodes (230) to be used to generate MR. The UE node (270) may use the list of BM and HMAC values ​​and a third timestamp (Timestamp3) to request the BMANF node (250) for BM verification. It can be encrypted as, It can be transmitted together.

[0081] Additionally, in steps 2a and 2b, the BMANF node (250) is a secret key Using After decoding It can obtain. Next, the BMANF node (250) can check the third timestamp (Timestamp3) and, if valid, verify the HMAC of the BM. If verification is successful, the BMANF node (250) can send a success message to the UE node (270) along with the fourth timestamp (Timestamp4). Otherwise, the BMANF node (250) can generate a list of submitted BMs and send it to the UE node (270) along with a failure message.

[0082] In the third step, the UE node (270) can verify the fourth timestamp (Timestamp4) after receiving a Message Verification Response message. If the fourth timestamp is valid, the UE node (270) can transmit the MR to the serving base station; otherwise, the verification step can be terminated by generating the MR with the gNB node (230) that failed verification excluded and transmitting it to the serving gNB node.

[0084] Figure 5 is a diagram illustrating the delay time of a cryptographic operation, Figure 6 is a diagram illustrating the performance and security of a fake base station defense system, and Figure 7 is a diagram illustrating the performance of a fake base station defense mechanism.

[0085] Referring to FIGS. 5 to 7, to measure and evaluate the performance of the protocol according to the present invention, a performance evaluation can be performed based on the latency of the encryption operation for each protocol, and the performance evaluation can be performed by measuring the computational overhead using an Apple MacBook Pro M1 MAX 64GB RAM. In conclusion, messages sent from the FBS can be prevented through the BMANF function, and the network can be protected from SON poisoning attacks by improving the data quality for the SON function.

[0086] Figure 7 illustrates the results of comparing the performance and security of the protocol according to the present invention with PKC, IBC, Group Key-based, and DSnF scheme protocols. Each graph can be distinguished and represented based on the broadcast period (Broadcasts per second), the density of gNBs, and the Round Trip Time (UE <-> gNB). Additionally, the overhead of each graph can be expressed as the total computational cost of the UE, gNB, and network functions (BMANF and DSnF).

[0087] Specifically, overhead measurements indicate that higher gNB density and shorter broadcast periods may result in higher overhead and require more encryption operations. Additionally, longer roundtrip times can lead to increased protocol latency, and overhead can increase proportionally as gNB density and broadcast periods shift from low to high.

[0088] According to Figures 6 and 7, the performance of PKC, IBC, and DSnF may have consistently high overhead as the density of gNBs and the frequency of broadcasts increase. The three protocols may have high overhead due to certificate transmission for PKC, ECDSA (Elliptic Curve Digital Signature Algorithm), and ECCSI (Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption) for identity-based encryption. Furthermore, compared to Group Key-based solutions, the three protocols may be less effective as the gap in computational cost widens as the density of gNBs and the frequency of broadcasts increase. In other words, existing Group Key-based solutions may experience lower overhead as the density of gNBs and the frequency of broadcasts increase.

[0089] The protocol according to the present invention may incur higher overhead than Group Key-based solutions in terms of Roundtrip time due to the addition of a BMANF located near the gNB controller. However, the protocol according to the present invention may reduce the burden on UEs with limited computing resources. On the other hand, UEs other than the present invention may perform frequent calculations because the BM transmission cycle is short.

[0090] In FIG. 6, the protocol according to the present invention can resolve security flaws found in the Group Key-based method and can satisfy all security requirements of SA (Sender Authentication), MI (Message Integrity), AV (Availability), and IT (Defense Against Insider Threat). Therefore, the protocol according to the present invention may be more suitable for UEs with limited computing resources because it is safer and more efficient than existing protocols.

[0092] FIG. 8 is a diagram illustrating the system configuration of a BMANF node according to the present invention.

[0093] Referring to FIG. 8, the BMANF node (250) may include a processor (810), memory (830), an input / output unit (850), and a transmission / reception unit (870).

[0094] The processor (810) can execute a group key-based protocol execution procedure according to an embodiment of the present invention, manage memory (830) that is read or written during this process, and schedule the synchronization time between volatile memory and non-volatile memory in memory (830). The processor (810) can control the overall operation of the BMANF node (250) and is electrically connected to the memory (830), input / output unit (850), and transmission / reception unit (870) to control the data flow between them. The processor (810) can be implemented as a CPU (Central Processing Unit) or GPU (Graphics Processing Unit) of the BMANF node (250). Meanwhile, the processor (810) may be implemented as a plurality of units depending on the system configuration.

[0095] The memory (830) may include a secondary storage device implemented as non-volatile memory such as an SSD (Solid State Disk) or HDD (Hard Disk Drive) and used to store all data required by the BMANF node (250), and may include a main memory device implemented as volatile memory such as RAM (Random Access Memory). Additionally, the memory (830) may store a set of instructions that execute the group key-based protocol execution method according to the present invention by being executed by an electrically connected processor (810).

[0096] The input / output unit (850) includes an environment for receiving user input and an environment for outputting specific information to the user, and may include an input device including an adapter such as a touch pad, touch screen, virtual keyboard, or pointing device, and an output device including an adapter such as a monitor or touch screen. In one embodiment, the input / output unit (850) may correspond to a computing device connected via remote access, and in such case, the BMANF node (250) may be performed as an independent server.

[0097] The transceiver (870) provides a communication environment for connecting with a terminal (UE) through a network and may include an adapter for communication such as a LAN (Local Area Network), MAN (Metropolitan Area Network), WAN (Wide Area Network), and VAN (Value Added Network). Additionally, the transceiver (870) may be implemented to provide short-range communication functions such as WiFi or Bluetooth, or wireless communication functions of 4G or higher, for wireless transmission of data. For example, the transceiver (870) may communicate with an AMF node (210) of a 5G core network through a secure channel.

[0099] FIG. 9 is a flowchart illustrating an example of the operation process of a BMANF node according to the present invention.

[0100] Referring to FIG. 9, the BMANF node (250) can receive a shared key mutually shared with the UE node (270) from the AMF node (210) (step S910). That is, in the initial stage of the protocol, the shared key can be distributed to the BMANF node (250) and the UE node (270) respectively by the AMF node (210).

[0101] Subsequently, the BMANF node (250) may receive a ticket request from the UE node (270) during the initial stage of the protocol (step S930), and may generate a ticket for the UE node (270) in accordance with the ticket request (step S950). At this time, the ticket generated by the BMANF node (250) may be included in a Ticket Response message, encrypted, and then transmitted to the UE node (270).

[0102] Afterward, the BMANF node (250) can delete the shared key after sending the ticket to the UE node (270) (step S970). Additionally, the UE node (270) can also delete the shared key from memory to ensure perfect forward secrecy, that is, the security of the session key obtained during the subsequent key distribution process should not be affected even if the secret key is exposed.

[0103] Afterward, once the initial phase is completed, the verification phase of the protocol may begin, and if the BMANF node (250) receives a verification request from the UE node (270), it may generate a verification result and send it to the UE node (270) (step S990). Accordingly, the UE node (270) may send an MR to the service gNB based on the verification result, or generate a new MR excluding the gNB that failed verification and send it to the service gNB.

[0105] Although the present invention has been described above with reference to preferred embodiments, those skilled in the art will understand that various modifications and changes can be made to the invention without departing from the spirit and scope of the invention as described in the following claims. Explanation of the symbols

[0107] 200: Protocol execution system 210: AMF Node 230: gNB Node 250: BMANF Node 270: UE Node 810: Processor 830: Memory 850: Input / Output Unit 870: Transmitter / Receiver Unit

Claims

Claim 1 In a method for executing a group key-based protocol utilizing BMANF between a UE (User Equipment) node and a BMANF (Broadcast Message Authentication Network Function) node when multiple gNB nodes form different groups within a tracking area managed by an AMF (Access and Mobility Function) node, the method comprises: a protocol initial phase in which a mutual shared key is distributed to each of the UE node and the BMANF node, and when a ticket generated by the BMANF node in accordance with a ticket request from the UE node is transmitted to the UE node, the shared key is deleted from each of the UE node and the BMANF node; A method for executing a group key-based protocol utilizing BMANF, comprising: a protocol verification phase initiated upon completion of the initial phase of the protocol, wherein when a broadcast message (BM) is transmitted to the UE node by the plurality of gNB nodes, a list regarding the broadcast message is generated by the UE node, and when a verification result generated by the BMANF node is transmitted to the UE node in accordance with the verification request of the UE node, a measurement report (MR) is transmitted from the UE node to each gNB node in accordance with the verification result. Claim 2 A method for executing a group key-based protocol utilizing BMANF, characterized in that, in claim 1, each of the plurality of gNB nodes mutually shares a root key that is provisioned by the AMF node and periodically updated. Claim 3 A method for executing a group key-based protocol using BMANF, characterized in that, in paragraph 2, each of the plurality of gNB nodes generates a base station key from the root key based on the corresponding group identifier and generates an HMAC of the broadcast message using the base station key. Claim 4 A method for performing a group key-based protocol utilizing BMANF, characterized in that, in claim 1, the protocol initial step includes a step of distributing the shared key to each of the UE node and the BMANF node according to a 5G registration mechanism. Claim 5 A method for performing a group key-based protocol utilizing BMANF, wherein, in claim 1, the protocol initial step comprises the step of the UE node encrypting Temporary Mobile Subscriber Identity (TMSI) based on the shared key and transmitting a ticket request message containing the encrypted Temporary Mobile Subscriber Identity to the BMANF node. Claim 6 A method for executing a group key-based protocol utilizing BMANF, characterized in that, in claim 5, the protocol initial step includes a step in which the ticket request message is decrypted by the BMANF node based on the shared key, and if the first timestamp included in the ticket request message is valid, a ticket and a ticket exchange key for the UE node are generated. Claim 7 A method for performing a group key-based protocol utilizing BMANF, characterized in that, in claim 6, the protocol initial step includes the step of the BMANF node encrypting the ticket and ticket exchange key based on the shared key and transmitting a ticket response message containing the encrypted ticket and ticket exchange key to the UE node. Claim 8 A method for executing a group key-based protocol utilizing BMANF, characterized in that, in claim 7, the protocol initial step includes a step in which the ticket response message is decrypted by the UE node based on the shared key, and the ticket and ticket exchange key are stored if the second timestamp included in the ticket response message is valid. Claim 9 A method for executing a group key-based protocol using BMANF according to claim 1, wherein the protocol verification step includes the step of generating a list regarding the broadcast message and the HMAC by the UE node when the broadcast message and the corresponding HMAC are transmitted to the UE node by each of the plurality of gNB nodes. Claim 10 A method for performing a group key-based protocol utilizing BMANF, characterized in that, in claim 9, the protocol verification step includes the step of transmitting to the BMANF node, together with the ticket stored in the protocol initial step, the broadcast message, the list regarding HMAC, and the third timestamp, after being encrypted by the UE node based on the ticket exchange key stored in the protocol initial step. Claim 11 A method for executing a group key-based protocol utilizing BMANF, characterized in that, in claim 10, the protocol verification step comprises the step of decrypting the ticket based on a secret key by the BMANF node and verifying the HMAC of the broadcast message if the third timestamp is valid, and if the verification is successful, transmitting a success message along with a fourth timestamp, and if not, generating a list of the corresponding broadcast messages and transmitting them along with the fourth timestamp and a failure message. Claim 12 A method for performing a group key-based protocol using BMANF, characterized in that, in claim 11, the protocol verification step includes a step in which, by the UE node, if the fourth timestamp of the verification result is valid, the measurement report is transmitted to the plurality of gNB nodes, and if not, the measurement report is transmitted to the remaining gNB nodes excluding the gNB nodes that failed the verification. Claim 13 A BMANF (Broadcast Message Authentication Network Function) node configured to perform a group key-based protocol execution method with a UE (User Equipment) node when multiple gNB nodes form different groups within a tracking area managed by an AMF (Access and Mobility Function) node, comprising: a transmitting and receiving unit; at least one processor; and a memory connected to and operating with said at least one processor and storing instructions for said at least one processor to perform a plurality of steps; wherein the plurality of steps include: receiving a shared key mutually shared with said UE node from said AMF node; receiving a ticket request from said UE node; generating a ticket for said UE node according to said ticket request; deleting the shared key after transmitting said ticket to said UE node; and, when a verification request is received from said UE node, generating a verification result and transmitting it to said UE node.

Images